CommodityWatch privacy policy

CommodityWatch is a commodity market monitoring service. This privacy policy applies to the website at commoditywatch.co and any related services we operate. It does not cover third-party sources we link to; those sites have their own policies.

By creating an account or using the service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service.

We collect the following categories of information:

• Account information. When you sign up, our authentication provider (Clerk) collects your email address and any optional profile information you choose to provide. We do not store passwords directly.
• Usage data. We collect basic log and analytics data such as pages visited, feature interactions, and approximate location derived from IP address. This helps us understand how the product is used and where it breaks.
• Contact information and correspondence. If you use the contact form, we process your name, email address and message, plus any company, phone number or topic you choose to provide. We also generate a non-sensitive enquiry reference so the submission can be tracked without putting your contact details in operational logs.

We use the information we collect to:

• Provide, maintain and improve the CommodityWatch service.
• Authenticate users and protect against abuse or unauthorised access.
• Understand aggregate usage patterns and diagnose technical issues.
• Review and respond to contact, support, privacy and data-quality enquiries.
• Communicate with you about service changes or security updates.

We do not sell your personal information. We do not use your data to build advertising profiles or share it with data brokers.

CommodityWatch uses a small number of third-party services to operate:

• Clerk for authentication, session management and user-account interfaces. Clerk's privacy policy governs the data it processes on our behalf.
• Cloudflare for hosting, edge delivery, transactional email and security. The contact form uses Cloudflare Turnstile, which processes browser and network signals needed to detect automated abuse. Cloudflare may process request logs and IP addresses as part of providing those services.
• Our destination mailbox provider receives contact-form messages so the CommodityWatch team can review and respond to them. The message then follows the mailbox's normal retention controls.
• Analytics providers if we use them, will be listed here with an explanation of what they collect and why.

We only share the minimum data necessary for these services to perform their functions. We do not authorise them to use your data for their own independent purposes.

We use cookies and similar technologies to keep you signed in, maintain session security, and remember your preferences. Clerk sets authentication cookies that are essential for the service to function.

We do not use non-essential third-party advertising cookies. If we add analytics or preference cookies that are not strictly necessary, we will update this policy and provide a choice mechanism where required.

Depending on your location, you may have the right to access, correct, delete or restrict the processing of your personal information. You can update many account details through the account page. For other requests, contact us using the details below.

We will respond to reasonable requests within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

We keep your account information for as long as your account is active. If you delete your account, we will remove or anonymise your personal information within a reasonable period, unless we are required by law to retain it.

Contact-form content is held in Worker memory only long enough to validate, format and send the enquiry. CommodityWatch does not copy the name, email, company, phone number, message, Turnstile token or IP address into its contact-delivery database. The delivered message remains in the destination inbox under its normal mailbox retention.

For reliability and duplicate suppression, we retain the enquiry reference, a one-way keyed hash of the idempotency key, delivery status or error category, and related timestamps for 30 days. A scheduled job then deletes that metadata.

Aggregated or de-identified usage data may be retained longer for analytical and operational purposes.

We may update this privacy policy from time to time. Material changes will be posted on this page with an updated effective date. Continued use of the service after changes constitutes acceptance of the revised policy.

If you have questions or concerns about this privacy policy or how we handle your data, use the contact form and select Privacy as the topic.